23 ms·

Windows 10 Enterprise ignores various privacy settings

467 points by tmkbry 9y ago

STRML 9y ago
If this test was correct, this smells like a class-action. Enterprise users (and home users, for that matter), have a right to control egress.
jmacpore 9y ago
Does anyone know a good updated firewall whitelist to allow just Windows Updates and nothing else?
- jacquesm 9y ago
  Any reason why you believe it would respect those rules? Note the one example where a rule was dynamically added to the firewall in the tweets listed here.
  - mitchty 9y ago
    Presumably you would put the rules at the router level not the os.
  - blacklistedfin 9y ago
    That doesn't matter if you're using a DNS blackhole or hardware firewall. Of course, MS could hard-code some IP addresses, too.
    - protomyth 9y ago
      I was deeply tempted to setup a Windows 10 Enterprise machine at work, then have my OpenBSD firewall add any IP the W10 machines tries to get to a block list.
- mschuster91 9y ago
  What does a firewall help when Windows can bypass it in the kernel? And embedded stuff aside, a system with a firewall whitelist on a separate box is unusable for daily use...
  - deleted 9y ago
    [deleted]
- CommanderData 9y ago
  Yes. I'm surprised it hasn't been mentioned here. https://github.com/crazy-max/WindowsSpyBlocker/tree/master/data https://github.com/crazy-max/WindowsSpyBlocker/tree/master/d... Comes in several formats: hosts, firewall, openwrt, dnscrypt. You can choose telemetry, update and extra. Has ip rules aswell as DNS rules. I am actually thinking of writing a modular openwrt luci plugin to make it easy to add to your router as it is only effective on router level as other have mentioned here. It's updated regularly, tested and one of the best lists out there, a clean copy and paste works into firewall rules as and there is nothing to install. Happy user. MS probably really dislikes this because they are adding new domains serving the same function almost every update.
  - crazymax 9y ago
    Hi, i'm the developer of WindowsSpyBlocker and it would be nice if you can contribute on the openwrt part :)
mrmondo 9y ago
Scary indeed, I've noticed that a Windows 10 'Pro' VM I have at times seems to reset or change privacy / security settings. A first I blamed myself for doing something silly without realising it affected these settings or installing some software that changed them (which is a little scary in itself) but then I realised it was after windows update had run, every few months privacy or security behaviour would change.
hendersoon 9y ago
That's surprising. I would expect the Enterprise edition to perform as advertised. It's a major revenue source and this violates all kinds of security policies. I find the author's point about people using third-party programs to stop Windows spying, and potentially impairing their security, very telling. He's absolutely correct. I use programs called Shutup10 and WinAero Tweaker to stop the telemetry myself, and both of these programs have settings that would potentially impair your security, primarily by stopping Windows Updates entirely. So the real question is this-- is this debacle the consumer's fault or Microsoft's? I know which side I'm on.
JumpCrisscross 9y ago
I run Windows in a Parallels VM on my Mac. This VM needs to, on occasion, connect to the Internet. Any way I can--from the outside, without needing to trust Windows--be forced to whitelist what the VM is and isn't allowed connect to?
- nthcolumn 9y ago
  outside /etc/hosts redirect to 0.0.0.0 inside (c:\Windows\System32\Drivers\etc\hosts) assuming it is being respected, but how to find list? is very difficult I think, as can change by Redmond c&c server at no notice,
  - sqldba 9y ago
    It's not respected.
  - rasz 9y ago
    microsoft hardcoded IPs of all its spy^^^value added services. As a matter of a fact DNSCache is one of the services used for uploading telemetry.
- johncolanduoni 9y ago
  IIRC Parallels in NAT ("Shared Network") mode will respect macOS's PF firewall. I'm not sure if the same is true for bridged virtual adapters.
- mcbridematt 9y ago
  I can't speak for Parallels, but for VMware Fusion in NAT mode all connections are made via the vmware-natd process which can be filtered by tools such as Little Snitch.
- edoceo 9y ago
  Under KVM the guest has a bridge adapter that you can set rules for on the host OS. So, you can mark, log and all that other fun stuff. Like route all DNS queries from guest to logging-cache DNS running on Host, block ports and full control of egress
oridecon 9y ago
Since the first release of W10 several registry keys and policies have changed in very confusing ways. I can't remember what exactly but I had to change my personal scripts several times based on the changelog of other tools. Privacy and settings like default apps were also reverted (reset to default) when you updated. They installed some apps like Candy Crush Saga on Enterprise. I don't see that much of a problem here, it's understandable since they are letting go of legacy stuff, bugs happens (even more after you cut your QA department). Now it's time to stop with all the excuses. Get your shit together. From: https://technet.microsoft.com/en-us/itpro/windows/manage/configure-windows-telemetry-in-your-organization https://technet.microsoft.com/en-us/itpro/windows/manage/con... > Security. Information that’s required to help keep Windows, Windows Server, and System Center secure, including data about the Connected User Experience and Telemetry component settings, the Malicious Software Removal Tool, and Windows Defender. I have all the possible settings configured, from registry to policies and I still see random connections everywhere. But it's ok because it's not telemetry, right? > What is NOT telemetry? > Telemetry can sometimes be confused with functional data. Is anyone taking legal actions against Microsoft about all of this? Does anyone care? Not everybody can switch all their machines to Linux/VMs, this whole situation makes me angry.
- DonkeyChan 9y ago
  I can't agree with this more. A client straight up failed a PCI compliance audit, replete with daily fines, for using 10 Enterprise. They decided to pursue legal measures against MS for false claims. I really hope this gets elevated because reverting to win 7 is a solution with a short life span. The other solution is to rebuild infrastructure on top of a different platform but that's prohibitively expensive.
  - DoofusOfDeath 9y ago
    > The other solution is to rebuild infrastructure on top of a different platform but that's prohibitively expensive. The more Microsoft degrades their viability for enterprise computing, the more market pressure will build (I think) for a different platform infrastructure. If / when the market reaches that tipping point, the schadenfreude will be overwhelming.
10165 9y ago
I read that Windows 10 uses peer-to-peer file sharing with any other Windows hosts it locates on the same network. This way each Windows computer does not have to connect to Microsoft to download, e.g., the Windows 10 "upgrade". It seems like this could also be used to evade attempts by users to block such downloads by blocking Microsoft IP addresses. Windows 10 could propagate itself through a network of Windows computers, like a ... Seriously, how does this work in pratice? Windows 10 does peer-to-peer file sharing automatically without requiring any user interaction?
- hendersoon 9y ago
  Yes, this is called "delivery optimization" and it's on by default. By default, Windows Enterprise/Education only pull updates from Microsoft and the local domain, while Windows Home/Pro will also pull updates from other peers on the internet. You can turn it off, or disable pulling from internet peers, but given the OP, who knows if MS actually respects that setting? I guess we have to roll the dice now. https://privacy.microsoft.com/en-us/windows-10-windows-update-delivery-optimization https://privacy.microsoft.com/en-us/windows-10-windows-updat...
  - glenneroo 9y ago
    Maybe they changed it, but I just checked my fresh install of Pro build 1703 from MSDN and it was disabled.
    - hendersoon 9y ago
      Odd, their docs say it's on by default. https://docs.microsoft.com/en-us/windows/deployment/update/waas-delivery-optimization https://docs.microsoft.com/en-us/windows/deployment/update/w...
      - glenneroo 9y ago
        One of the handful of tools I installed from Ninite must have turned it off then. After a quick look, I'm guessing it was Classic Start Menu.
makecheck 9y ago
Frankly, “settings” in an OS don’t fill me with any more confidence than “settings” on Facebook: software has bugs, and other reasons for not working as advertised. A toggle switch coded with the best of intentions may still not be consulted everywhere that it should, and even software that is correct today can be wrong in 3 months when somebody important quits or a feature is added and nobody thought to check the setting for that new feature. If this is important to you, demand more open and peer-reviewed source code, and demand that things run behind carefully-controlled walls like sandboxes and limited host files. Don’t just run your organization by trusting one software vendor.
quickben 9y ago
Another year of another decade; Microsoft as dishonorable as ever.
- brianwawok 9y ago
  But look, then allow you to run their database on Linux now!! It's proven time and time again that if the entire org isn't behind something, the good deeds of some get vastly overshadowed by these kind of games.
  - m_fayer 9y ago
    I really wish that the company that makes .net and azure could be split off from the rest of msft.
DonkeyChan 9y ago
MS Support consistently and repeatedly told me that enterprise allowed me to disable this stuff. If I can't control the egress then I can't verify PCI compliance. I've already had to revert a client to Win 7 because they failed a PCI compliance audit using Win 10 Enterprise. Which, by the way, is very expensive for small businesses. Win 10 Enterprise isn't viable for business. I have a bunch of small business clients and I've had to use a whitelist firewall to pass PCI compliance, someone said here that a whitelist firewall is borderline unusable. I've sunk so much time into that solution and I can attest, it's not viable.
- JustSomeNobody 9y ago
  I don't think they do it on purpose. I think Windows is just a patchwork of cruft at this point. I'm sure the Enterprise version shares all the code with the non Enterprise versions which have all the spying ... analytics... enabled, so bugs are bound to happen that let this escape into the Enterprise version.
  - oridecon 9y ago
    The fact that they renamed the telemetry setting from "Off" to "Security" is no coincidence.
    - JustSomeNobody 9y ago
      Point taken...
  - DonkeyChan 9y ago
    Whether it's incompetence or malice, it's wholly unprofessional. My confidence was already shaken with MS through their entire Win 10 Campaign and it's now completely gone. Their paid support services are hit and miss and if I'm going to end up supporting things that my client is paying MS to support then they're out and my client gets a smaller TCO overall. I'll have to work with some of them so their business remain viable during the transition but I'm willing to do that. Their growth is our growth. Payment plans, trade, whatever we can come up with to make this happen. For every one thing MS has done, loudly, in the attempt to instill trust they've done 5 things, quietly, that harm it. There are too many viable platforms available and if money is the only obstacle then I'll mitigate that for our clients benefit.
deleted 9y ago
[deleted]
allears 9y ago
This is a little chilling. As a home user on Win7, I've avoided Win10, but thought I'd eventually upgrade, just to enjoy newer hardware. I'd thought I could just invest in Enterprise, about $100 these days, and be able to control the more intrusive aspects. Guess not. On a semi-related note, I'm using uMatrix, and it never ceases to amaze me how promiscuous every single web site is these days. It's not just in Soviet Russia. You don't use the internet. The internet uses you.
- nol13 9y ago
  Well ya still chilling I guess, but so obviously expected it kind of takes away some of the chill factor. If you want to control your software, run software that you control.
blibble 9y ago
every few weeks Microsoft validate my decision to move my (declining) use of Windows entirely into VMs if gaming is the problem you can run Windows in a VM at 97% native speed with GFX passthrough, been doing this for almost 2 years now without any problems the vfio subreddit has a lot of info: https://www.reddit.com/r/VFIO/ https://www.reddit.com/r/VFIO/ MS are then free to spy on me playing starcraft as much as they want
- Sephr 9y ago
  It doesn't help that Nvidia's drivers intentionally stop working when they detect a consumer card functioning through VT-D in a virtualized environment.
  - blibble 9y ago
    you can patch the driver, and next time you upgrade don't purchase an nvidia product
nol13 9y ago
something something RMS something something..
tjalfi 9y ago
The connections in the first screenshot[0] aren't necessarily from Microsoft. This screenshot shows a DNS lookup for google-analytics.com followed by an attempt to use Teredo. If Chrome is installed then this could be from the Google Update service. It seems unlikely that Microsoft would send usage information to a Google site. [0] https://twitter.com/m8urnett/status/866353982217699328 https://twitter.com/m8urnett/status/866353982217699328 Edited to omit needless words
- wildrhythms 9y ago
  Chrome is not installed according to this tweet: "Also note this is a system with minimal software install, all default windows store apps removed, and nothing running on it." https://twitter.com/m8urnett/status/866354381012189184 https://twitter.com/m8urnett/status/866354381012189184
  - tjalfi 9y ago
    I saw that tweet but I still doubt that any Windows 10 service would connect to analytics.google.com. It seems more likely that he has a Google application installed. Edited to reword the second sentence.
    - benjaminjackman 9y ago
      Doesn't have to be a user installed google app. Google analytics use is ubiquitous for mobile and web apps could easily be something Microsoft bundled into their os like for example candy crush (not implying that's the culprit) or something that carries over that pervasive track every click and mousemove type mentality.
- deleted 9y ago
  [deleted]
- m8urn 9y ago
  Here is the list of installed applications: http://imgur.com/a/mdrTv http://imgur.com/a/mdrTv Also note that the only third-party software running at the time was wireshark, DNSQuerySniffer, and Glasswire.
proactivesvcs 9y ago
Keeping in mind that Google and AdNexus have both been caught permitting malicious advertisements on their ad networks. As well as Microsoft :-)
hilbert42 9y ago
Frankly, I am fed up trying to block the "phone-home" connections between our PCs and Microsoft and we're still only using Windows 7. There is absolutely no way we would ever use Windows 10 unless we could guarantee that we could totally sever all such connections permanently and not have to worry about them again. Moreover, for some years now we have considered our Windows operating systems as 'hostile' privacy-busting code on our PCs and if there was some easy way we could get rid of them then we would do so in an instant (please don't come at me with the Linux bumph/argument because in many instances it's not a possible option). This really is tiresome, why can't we just buy Windows/Microsoft busting routers that have a big red button on them that says: "Stop all Phone-home to Microsoft" or alternatively ones that have easily updatable blocking lists/text files that we can easily administer/download to them? This ought to be an easy no-brainer but it isn't! Why is it that router manufacturers, etc. aren't falling all over themselves to provide such devices? I'm amazed that they're not, one would think there'd be dozens of available by now; are manufactures that timid and afraid of Microsoft that they're not game to make them? Furthermore, it is not only a Microsoft Windows O/S problem, as these days just about all software talks home without seeking the user's permission to do so beforehand, and none of them tell you exactly what information is being transmitting home. It seems to me that we users will never solve this "talk home" problem until we have easy to use gateways that are external to our PCs, phones etc. that automatically block all "phone-home" addresses. BTW, anyone thinking of developing such a device needs to keep in mind that for years Microsoft has hard-coded within Windows certain IP address that bypass the hosts file irrespective of how it is set so that it is impossible to block Windows completely from talking home. Thus, there is no other option other than to block these addresses by means that are external to the PC/device! A final point: Microsoft could claim that as it has provided the upgrade to Windows 10 free and that entitles it to sap the private life info out of its users. I would counter that by saying that if alternatively I actually buy/pay for the operating system then I'm entitled to have complete control over it—and that means no talkback to Microsoft by the OS. Of course, none of this would be a problem now if the Microsoft monopoly had been busted years ago (i.e. if our fearful democracies had been game enough to use already existing law to thwart the monopoly early on).
- boomboomsubban 9y ago
ddevault 9y ago
The switch to Linux or other free operating systems is long overdue. If your excuse is hardware support, then (1) your hardware is probably supported these days and (2) you should not buy hardware that is incompatible with the operating system you plan to use. If your excuse is editing MS Office files, LibreOffice supports the formats and works great, and MS Office on Wine is an option. If your excuse is games, then know that with Steam and Wine combined your potential gaming library is HUGE. If your excuse is laziness or resistance to change, then I thank you for being honest, and urge you to overcome it. Proprietary operating systems work against your interests. Stop using them.
- sathackr 9y ago
  Been on Ubuntu for a bit over a year now. Steam works great, and LibreOffice has been good enough to get the job done. I run Google Earth Pro and Sketchup in Wine, even World of Warcraft runs quite well in Wine. I had a ton of issues with Wine until I found PlayOnLinux. Things still don't quite 'just work' -- but I've been able to use way more than I could before I found it. KSP and WoW are my two big games, and they both work fine.
  - dvtv75 9y ago
    I had never heard of PlayOnLinux until now. Installed - thanks for the tip! KSP and Rimworld are my two big games, at least KSP will be again when I get a replacement video card.
    - sathackr 9y ago
      Np. I messed around for a bit till I found it also. I'm surprised it didn't pop up on my radar previously. It's really helped me a ton with getting things working under Ubuntu. I haven't played Rimworld yet. Might have to go check it out. I've found TerraTech recently but I've had about as much fun as I can have with it until they fix some more things.
    - AimHere 9y ago
      You're in luck - you don't even need wine for either of those games since they're Linux-native.
yuhong 9y ago
Notice at least two MS employees responded to this thread. I posted myself in another one: https://twitter.com/yuhong2/status/863463634281746433 https://twitter.com/yuhong2/status/863463634281746433
danielcberman 9y ago
Has anyone done an analysis of MacOS and Chrome OS using similar methodologies? I would be curious as to the extent of the information being sent back to each of the "Mother Ships" in a side by side comparison, if that's even possible.
- kalleboo 9y ago
  Little Snitch is a popular bit of software on the Mac, and pretty much everyone who uses thst goes through the first week of googling "so what's this weird background process do?"
  - jmnicolas 9y ago
    A software firewall is useless, the OS can hide from it. You need something external to your machine to be sure.
withinrafael 9y ago
Most of his configuration is invalid, due to his misconfiguration of group policy. For example, he disabled the Teredo policy. But here's the help text for that policy: "If you disable or do not configure this policy setting, the local host settings are used." He made this error countless times, rendering the entire experiment a failure. Oops.
- PhantomGremlin 9y ago
  Most of his configuration is invalid, due to his misconfiguration of group policy. Yeah, it's his fault that he didn't properly navigate the Kafkaesque nightmare that Microsoft has created in order to thwart people from disabling all this spyware.
  - brainfire 9y ago
    It's pretty basic Windows GPO knowledge. Lots of them work this way.
    - mjevans 9y ago
      It's a pretty broken configuration system that makes it needlessly difficult to do things the correct way.
      - cwyers 9y ago
        It's a pretty shoddy security researcher that doesn't read the documentation before posting a lot of falsehoods to Twitter.
        flukus 9y ago
        Shoddy or realistic? I'd hope more security researchers work with systems that aren't perfectly configured because they won't be in the real world.
        9y ago
awqrre 9y ago
Microsoft went Google evil on this product...
dingo_bat 9y ago
I actually like this. Fuck the enterprises who degrade the experience for their users. Disable this disable that. Install shit like McAfee. They just need an excuse for their existence. And the users are the ones to suffer, and the company loses precious productivity without knowing it. I know companies that will pre install McAfee in the brand new MacBooks they give out to employees! It's insane. Microsoft should just say, if you want to use our OS, stop fucking with it.
gub09 9y ago
The "Year of the Linux Desktop" has been a running joke for a long time, but perhaps it's no longer a joke. Not wanting to lose control as far as updates and privacy is concerned, I switched to Linux when Windows 10 came out. Running Debian Testing with Gnome has been a joy. In my opinion the user experience is easier and better than that of Windows 7 or 8. Office staff could quite easily be trained to click on the Start key or the drop-down Activities menu or move the mouse to the top-left corner to start a program. Office software is quite good. Program-switching keyboard combinations are excellent. The Evolution mail client is very good. Browser software is the same as on Windows or a Mac. Problems with bad fonts, poorly designed UI, lacking drivers etc. are things of the past (with the notable exception of very new hardware). This may not be possible due to the necessity of using specific proprietary programs that run only on Windows, for example. On the other hand, the level of tech support required is perhaps not significantly greater than what is necessary for installing and maintaining Windows on a bunch of machines. On the plus side, everything is very fast, tasks like backing up files or systems are simple with GUI or terminal interface, and if you want to learn iptables and set up that router/firewall you can do that too. Everything you learn is an investment instead of an annoyance. Nobody is going through your company or personal files to serve you ads. There's no reason any more, besides defaults and inertia, why Linux should have 2% desktop market share instead of 10% of somewhat technical people or even 20 or 30% of the general population.
partycoder 9y ago
Just a reminder for Windows users: in most cases, you no longer need Windows. All your pain is completely voluntary.
- vkou 9y ago
  Your pain after you switch to Linux will be completely voluntary, too.
  - quickben 9y ago
    Windows pain costs few hundred $ more :)
    - epsylon 9y ago
      Only if your time is worthless.
      - iammyIP 9y ago
        That is quite a stupid argument which you seem to just rephrase without having thought about it, as you could aswell say then that healthy eating takes some more time and consideration than running to the next fast food burger, thus you can only eat healthy if your time is worthless. Or how about developing new energy sources if we can just burn all the oil much easier? Sometimes some efforts have to be done to have nice things. See how dumb this 'Only if your time is worthless' sounds now?
      - partycoder 9y ago
        Linux has evolved a lot. Some years ago it was very likely for you to have to recompile the kernel to get your box running... I haven't been in that scenario lately (using Ubuntu). Then, some distros/desktop environments are even friendlier than Windows itself. elementary OS for instance, is very minimalistic and simple. So I have to disagree with you.
      - quickben 9y ago
        I properly cash in on my time spent learning Linux when I was younger. My free time is worth a lot now ;)
exodust 9y ago
Twitter has this thing called "moments" for combining multiple tweets and avoiding what this person has done. I guess he's only an IT security analyst so perhaps isn't up to speed. https://support.twitter.com/articles/20174961# https://support.twitter.com/articles/20174961#
thr0waway1239 9y ago
This might actually be a pretty huge opportunity for a company which can hand hold the transitioning from Windows to Linux in an enterprise. After all, if the new Windows OS is provably non-compliant, shouldn't the enterprise customers be very willing to investigate this option? Are there already companies which do this?
blitmap 9y ago
I always use Linux as my preferred OS and a "Just Works" OS like macOS or Windows. I run Linux as a dual-boot and I run it in a VM from Windows/mac. It's frustrating because Apple has fallen far behind on hardware I want. I need 3840x2160, a touchscreen, a card reader, both USB 3.0 and 3.1, 16GB of RAM, and full-size HDMI. They've jumped too far ahead into their 'revolutionary' view of the future. I can find better hardware for much cheaper. Dell XPS 13, HP Envy 2-in-1, Toshiba Radius 12... the build quality on the Toshiba is pretty bad, but it out-performs a would-be Macbook. I'm not spending 2 -fucking- thousand dollars for sub-standard hardware simply because I like the OS better than Windows. Apple spies on its users, but at least when you turn it off it's actually off. I can't continue using Windows because it's clearly hostile to users, and I can't go with Apple because the hardware sucks. Linux requires so much involvement to keep it running "well". Just argh.
- slazaro 9y ago
  We just need a billionaire benevolent dictator to fund a distribution of Linux and relevant programs that turns it into something stable and user friendly.
  - deleted 9y ago
    [deleted]
  - kogepathic 9y ago
    > We just need a billionaire benevolent dictator to fund a distribution of Linux I might be missing the joke here, is this a jab at Mark Shuttleworth?
    - slazaro 9y ago
      Not intended, but I do think Ubuntu was a missed opportunity by trying to innovate instead of focusing on stability, familiarity, and user-friendliness.
      - madez 9y ago
MikusR 9y ago
https://docs.microsoft.com/lv-lv/windows/configuration/manage-connections-from-windows-operating-system-components-to-microsoft-services https://docs.microsoft.com/lv-lv/windows/configuration/manag...
davidgerard 9y ago
This is the other reason WannaCry happened: 97% Windows 7 machines without updates. Because users can't trust Microsoft not to mess them around.
intoverflow2 9y ago
Ignoring people who need to control what leaves their systems for legal reasons I always find it odd how much the hardcore Windows users freak out over stuff like this. I mean you trust your entire digital life to this OS yet the idea of analytics being sent back to the people who made the OS terrifies you? They also seem to freak out and declare certain versions near unusable when I've recently started using Win 10 after not using Windows since Win 2K and honestly it's 90% the same thing to me. Also interested as to how many people freaking out over telemetry use Google software.
deleted 9y ago
[deleted]
optikals 9y ago
time to switch...

467 points by tmkbry 9y ago

If this test was correct, this smells like a class-action. Enterprise users (and home users, for that matter), have a right to control egress.

jmacpore 9y ago

Does anyone know a good updated firewall whitelist to allow just Windows Updates and nothing else?

jacquesm 9y ago
Any reason why you believe it would respect those rules? Note the one example where a rule was dynamically added to the firewall in the tweets listed here.
- mitchty 9y ago
  Presumably you would put the rules at the router level not the os.
- blacklistedfin 9y ago
  That doesn't matter if you're using a DNS blackhole or hardware firewall. Of course, MS could hard-code some IP addresses, too.
  - protomyth 9y ago
    I was deeply tempted to setup a Windows 10 Enterprise machine at work, then have my OpenBSD firewall add any IP the W10 machines tries to get to a block list.
mschuster91 9y ago
What does a firewall help when Windows can bypass it in the kernel? And embedded stuff aside, a system with a firewall whitelist on a separate box is unusable for daily use...
- deleted 9y ago
  [deleted]
CommanderData 9y ago
Yes. I'm surprised it hasn't been mentioned here. https://github.com/crazy-max/WindowsSpyBlocker/tree/master/data https://github.com/crazy-max/WindowsSpyBlocker/tree/master/d... Comes in several formats: hosts, firewall, openwrt, dnscrypt. You can choose telemetry, update and extra. Has ip rules aswell as DNS rules. I am actually thinking of writing a modular openwrt luci plugin to make it easy to add to your router as it is only effective on router level as other have mentioned here. It's updated regularly, tested and one of the best lists out there, a clean copy and paste works into firewall rules as and there is nothing to install. Happy user. MS probably really dislikes this because they are adding new domains serving the same function almost every update.
- crazymax 9y ago
  Hi, i'm the developer of WindowsSpyBlocker and it would be nice if you can contribute on the openwrt part :)

mrmondo 9y ago

Scary indeed, I've noticed that a Windows 10 'Pro' VM I have at times seems to reset or change privacy / security settings. A first I blamed myself for doing something silly without realising it affected these settings or installing some software that changed them (which is a little scary in itself) but then I realised it was after windows update had run, every few months privacy or security behaviour would change.

hendersoon 9y ago

That's surprising. I would expect the Enterprise edition to perform as advertised. It's a major revenue source and this violates all kinds of security policies. I find the author's point about people using third-party programs to stop Windows spying, and potentially impairing their security, very telling. He's absolutely correct. I use programs called Shutup10 and WinAero Tweaker to stop the telemetry myself, and both of these programs have settings that would potentially impair your security, primarily by stopping Windows Updates entirely. So the real question is this-- is this debacle the consumer's fault or Microsoft's? I know which side I'm on.

JumpCrisscross 9y ago

I run Windows in a Parallels VM on my Mac. This VM needs to, on occasion, connect to the Internet. Any way I can--from the outside, without needing to trust Windows--be forced to whitelist what the VM is and isn't allowed connect to?

nthcolumn 9y ago
outside /etc/hosts redirect to 0.0.0.0 inside (c:\Windows\System32\Drivers\etc\hosts) assuming it is being respected, but how to find list? is very difficult I think, as can change by Redmond c&c server at no notice,
- sqldba 9y ago
  It's not respected.
- rasz 9y ago
  microsoft hardcoded IPs of all its spy^^^value added services. As a matter of a fact DNSCache is one of the services used for uploading telemetry.
johncolanduoni 9y ago
IIRC Parallels in NAT ("Shared Network") mode will respect macOS's PF firewall. I'm not sure if the same is true for bridged virtual adapters.
mcbridematt 9y ago
I can't speak for Parallels, but for VMware Fusion in NAT mode all connections are made via the vmware-natd process which can be filtered by tools such as Little Snitch.
edoceo 9y ago
Under KVM the guest has a bridge adapter that you can set rules for on the host OS. So, you can mark, log and all that other fun stuff. Like route all DNS queries from guest to logging-cache DNS running on Host, block ports and full control of egress

oridecon 9y ago

Since the first release of W10 several registry keys and policies have changed in very confusing ways. I can't remember what exactly but I had to change my personal scripts several times based on the changelog of other tools. Privacy and settings like default apps were also reverted (reset to default) when you updated. They installed some apps like Candy Crush Saga on Enterprise. I don't see that much of a problem here, it's understandable since they are letting go of legacy stuff, bugs happens (even more after you cut your QA department). Now it's time to stop with all the excuses. Get your shit together. From: https://technet.microsoft.com/en-us/itpro/windows/manage/configure-windows-telemetry-in-your-organization https://technet.microsoft.com/en-us/itpro/windows/manage/con... > Security. Information that’s required to help keep Windows, Windows Server, and System Center secure, including data about the Connected User Experience and Telemetry component settings, the Malicious Software Removal Tool, and Windows Defender. I have all the possible settings configured, from registry to policies and I still see random connections everywhere. But it's ok because it's not telemetry, right? > What is NOT telemetry? > Telemetry can sometimes be confused with functional data. Is anyone taking legal actions against Microsoft about all of this? Does anyone care? Not everybody can switch all their machines to Linux/VMs, this whole situation makes me angry.

DonkeyChan 9y ago
I can't agree with this more. A client straight up failed a PCI compliance audit, replete with daily fines, for using 10 Enterprise. They decided to pursue legal measures against MS for false claims. I really hope this gets elevated because reverting to win 7 is a solution with a short life span. The other solution is to rebuild infrastructure on top of a different platform but that's prohibitively expensive.
- DoofusOfDeath 9y ago
  > The other solution is to rebuild infrastructure on top of a different platform but that's prohibitively expensive. The more Microsoft degrades their viability for enterprise computing, the more market pressure will build (I think) for a different platform infrastructure. If / when the market reaches that tipping point, the schadenfreude will be overwhelming.

10165 9y ago

I read that Windows 10 uses peer-to-peer file sharing with any other Windows hosts it locates on the same network. This way each Windows computer does not have to connect to Microsoft to download, e.g., the Windows 10 "upgrade". It seems like this could also be used to evade attempts by users to block such downloads by blocking Microsoft IP addresses. Windows 10 could propagate itself through a network of Windows computers, like a ... Seriously, how does this work in pratice? Windows 10 does peer-to-peer file sharing automatically without requiring any user interaction?

hendersoon 9y ago
Yes, this is called "delivery optimization" and it's on by default. By default, Windows Enterprise/Education only pull updates from Microsoft and the local domain, while Windows Home/Pro will also pull updates from other peers on the internet. You can turn it off, or disable pulling from internet peers, but given the OP, who knows if MS actually respects that setting? I guess we have to roll the dice now. https://privacy.microsoft.com/en-us/windows-10-windows-update-delivery-optimization https://privacy.microsoft.com/en-us/windows-10-windows-updat...
- glenneroo 9y ago
  Maybe they changed it, but I just checked my fresh install of Pro build 1703 from MSDN and it was disabled.
  - hendersoon 9y ago
    Odd, their docs say it's on by default. https://docs.microsoft.com/en-us/windows/deployment/update/waas-delivery-optimization https://docs.microsoft.com/en-us/windows/deployment/update/w...
    - glenneroo 9y ago
      One of the handful of tools I installed from Ninite must have turned it off then. After a quick look, I'm guessing it was Classic Start Menu.

makecheck 9y ago

Frankly, “settings” in an OS don’t fill me with any more confidence than “settings” on Facebook: software has bugs, and other reasons for not working as advertised. A toggle switch coded with the best of intentions may still not be consulted everywhere that it should, and even software that is correct today can be wrong in 3 months when somebody important quits or a feature is added and nobody thought to check the setting for that new feature. If this is important to you, demand more open and peer-reviewed source code, and demand that things run behind carefully-controlled walls like sandboxes and limited host files. Don’t just run your organization by trusting one software vendor.

quickben 9y ago

Another year of another decade; Microsoft as dishonorable as ever.

brianwawok 9y ago
But look, then allow you to run their database on Linux now!! It's proven time and time again that if the entire org isn't behind something, the good deeds of some get vastly overshadowed by these kind of games.
- m_fayer 9y ago
  I really wish that the company that makes .net and azure could be split off from the rest of msft.

DonkeyChan 9y ago

MS Support consistently and repeatedly told me that enterprise allowed me to disable this stuff. If I can't control the egress then I can't verify PCI compliance. I've already had to revert a client to Win 7 because they failed a PCI compliance audit using Win 10 Enterprise. Which, by the way, is very expensive for small businesses. Win 10 Enterprise isn't viable for business. I have a bunch of small business clients and I've had to use a whitelist firewall to pass PCI compliance, someone said here that a whitelist firewall is borderline unusable. I've sunk so much time into that solution and I can attest, it's not viable.

JustSomeNobody 9y ago
I don't think they do it on purpose. I think Windows is just a patchwork of cruft at this point. I'm sure the Enterprise version shares all the code with the non Enterprise versions which have all the spying ... analytics... enabled, so bugs are bound to happen that let this escape into the Enterprise version.
- oridecon 9y ago
  The fact that they renamed the telemetry setting from "Off" to "Security" is no coincidence.
  - JustSomeNobody 9y ago
    Point taken...
- DonkeyChan 9y ago
  Whether it's incompetence or malice, it's wholly unprofessional. My confidence was already shaken with MS through their entire Win 10 Campaign and it's now completely gone. Their paid support services are hit and miss and if I'm going to end up supporting things that my client is paying MS to support then they're out and my client gets a smaller TCO overall. I'll have to work with some of them so their business remain viable during the transition but I'm willing to do that. Their growth is our growth. Payment plans, trade, whatever we can come up with to make this happen. For every one thing MS has done, loudly, in the attempt to instill trust they've done 5 things, quietly, that harm it. There are too many viable platforms available and if money is the only obstacle then I'll mitigate that for our clients benefit.

deleted 9y ago

[deleted]

allears 9y ago

This is a little chilling. As a home user on Win7, I've avoided Win10, but thought I'd eventually upgrade, just to enjoy newer hardware. I'd thought I could just invest in Enterprise, about $100 these days, and be able to control the more intrusive aspects. Guess not. On a semi-related note, I'm using uMatrix, and it never ceases to amaze me how promiscuous every single web site is these days. It's not just in Soviet Russia. You don't use the internet. The internet uses you.

nol13 9y ago
Well ya still chilling I guess, but so obviously expected it kind of takes away some of the chill factor. If you want to control your software, run software that you control.

blibble 9y ago

every few weeks Microsoft validate my decision to move my (declining) use of Windows entirely into VMs if gaming is the problem you can run Windows in a VM at 97% native speed with GFX passthrough, been doing this for almost 2 years now without any problems the vfio subreddit has a lot of info: https://www.reddit.com/r/VFIO/ https://www.reddit.com/r/VFIO/ MS are then free to spy on me playing starcraft as much as they want

Sephr 9y ago
It doesn't help that Nvidia's drivers intentionally stop working when they detect a consumer card functioning through VT-D in a virtualized environment.
- blibble 9y ago
  you can patch the driver, and next time you upgrade don't purchase an nvidia product

nol13 9y ago

something something RMS something something..

tjalfi 9y ago

The connections in the first screenshot[0] aren't necessarily from Microsoft. This screenshot shows a DNS lookup for google-analytics.com followed by an attempt to use Teredo. If Chrome is installed then this could be from the Google Update service. It seems unlikely that Microsoft would send usage information to a Google site. [0] https://twitter.com/m8urnett/status/866353982217699328 https://twitter.com/m8urnett/status/866353982217699328 Edited to omit needless words

wildrhythms 9y ago
Chrome is not installed according to this tweet: "Also note this is a system with minimal software install, all default windows store apps removed, and nothing running on it." https://twitter.com/m8urnett/status/866354381012189184 https://twitter.com/m8urnett/status/866354381012189184
- tjalfi 9y ago
  I saw that tweet but I still doubt that any Windows 10 service would connect to analytics.google.com. It seems more likely that he has a Google application installed. Edited to reword the second sentence.
  - benjaminjackman 9y ago
    Doesn't have to be a user installed google app. Google analytics use is ubiquitous for mobile and web apps could easily be something Microsoft bundled into their os like for example candy crush (not implying that's the culprit) or something that carries over that pervasive track every click and mousemove type mentality.
deleted 9y ago
[deleted]
m8urn 9y ago
Here is the list of installed applications: http://imgur.com/a/mdrTv http://imgur.com/a/mdrTv Also note that the only third-party software running at the time was wireshark, DNSQuerySniffer, and Glasswire.

proactivesvcs 9y ago

Keeping in mind that Google and AdNexus have both been caught permitting malicious advertisements on their ad networks. As well as Microsoft :-)

hilbert42 9y ago

Frankly, I am fed up trying to block the "phone-home" connections between our PCs and Microsoft and we're still only using Windows 7. There is absolutely no way we would ever use Windows 10 unless we could guarantee that we could totally sever all such connections permanently and not have to worry about them again. Moreover, for some years now we have considered our Windows operating systems as 'hostile' privacy-busting code on our PCs and if there was some easy way we could get rid of them then we would do so in an instant (please don't come at me with the Linux bumph/argument because in many instances it's not a possible option). This really is tiresome, why can't we just buy Windows/Microsoft busting routers that have a big red button on them that says: "Stop all Phone-home to Microsoft" or alternatively ones that have easily updatable blocking lists/text files that we can easily administer/download to them? This ought to be an easy no-brainer but it isn't! Why is it that router manufacturers, etc. aren't falling all over themselves to provide such devices? I'm amazed that they're not, one would think there'd be dozens of available by now; are manufactures that timid and afraid of Microsoft that they're not game to make them? Furthermore, it is not only a Microsoft Windows O/S problem, as these days just about all software talks home without seeking the user's permission to do so beforehand, and none of them tell you exactly what information is being transmitting home. It seems to me that we users will never solve this "talk home" problem until we have easy to use gateways that are external to our PCs, phones etc. that automatically block all "phone-home" addresses. BTW, anyone thinking of developing such a device needs to keep in mind that for years Microsoft has hard-coded within Windows certain IP address that bypass the hosts file irrespective of how it is set so that it is impossible to block Windows completely from talking home. Thus, there is no other option other than to block these addresses by means that are external to the PC/device! A final point: Microsoft could claim that as it has provided the upgrade to Windows 10 free and that entitles it to sap the private life info out of its users. I would counter that by saying that if alternatively I actually buy/pay for the operating system then I'm entitled to have complete control over it—and that means no talkback to Microsoft by the OS. Of course, none of this would be a problem now if the Microsoft monopoly had been busted years ago (i.e. if our fearful democracies had been game enough to use already existing law to thwart the monopoly early on).

boomboomsubban 9y ago

ddevault 9y ago

The switch to Linux or other free operating systems is long overdue. If your excuse is hardware support, then (1) your hardware is probably supported these days and (2) you should not buy hardware that is incompatible with the operating system you plan to use. If your excuse is editing MS Office files, LibreOffice supports the formats and works great, and MS Office on Wine is an option. If your excuse is games, then know that with Steam and Wine combined your potential gaming library is HUGE. If your excuse is laziness or resistance to change, then I thank you for being honest, and urge you to overcome it. Proprietary operating systems work against your interests. Stop using them.

sathackr 9y ago
Been on Ubuntu for a bit over a year now. Steam works great, and LibreOffice has been good enough to get the job done. I run Google Earth Pro and Sketchup in Wine, even World of Warcraft runs quite well in Wine. I had a ton of issues with Wine until I found PlayOnLinux. Things still don't quite 'just work' -- but I've been able to use way more than I could before I found it. KSP and WoW are my two big games, and they both work fine.
- dvtv75 9y ago
  I had never heard of PlayOnLinux until now. Installed - thanks for the tip! KSP and Rimworld are my two big games, at least KSP will be again when I get a replacement video card.
  - sathackr 9y ago
    Np. I messed around for a bit till I found it also. I'm surprised it didn't pop up on my radar previously. It's really helped me a ton with getting things working under Ubuntu. I haven't played Rimworld yet. Might have to go check it out. I've found TerraTech recently but I've had about as much fun as I can have with it until they fix some more things.
  - AimHere 9y ago
    You're in luck - you don't even need wine for either of those games since they're Linux-native.

yuhong 9y ago

Notice at least two MS employees responded to this thread. I posted myself in another one: https://twitter.com/yuhong2/status/863463634281746433 https://twitter.com/yuhong2/status/863463634281746433

danielcberman 9y ago

Has anyone done an analysis of MacOS and Chrome OS using similar methodologies? I would be curious as to the extent of the information being sent back to each of the "Mother Ships" in a side by side comparison, if that's even possible.

kalleboo 9y ago
Little Snitch is a popular bit of software on the Mac, and pretty much everyone who uses thst goes through the first week of googling "so what's this weird background process do?"
- jmnicolas 9y ago
  A software firewall is useless, the OS can hide from it. You need something external to your machine to be sure.

withinrafael 9y ago

Most of his configuration is invalid, due to his misconfiguration of group policy. For example, he disabled the Teredo policy. But here's the help text for that policy: "If you disable or do not configure this policy setting, the local host settings are used." He made this error countless times, rendering the entire experiment a failure. Oops.

PhantomGremlin 9y ago
Most of his configuration is invalid, due to his misconfiguration of group policy. Yeah, it's his fault that he didn't properly navigate the Kafkaesque nightmare that Microsoft has created in order to thwart people from disabling all this spyware.
- brainfire 9y ago
  It's pretty basic Windows GPO knowledge. Lots of them work this way.
  - mjevans 9y ago
    It's a pretty broken configuration system that makes it needlessly difficult to do things the correct way.
    - cwyers 9y ago
      It's a pretty shoddy security researcher that doesn't read the documentation before posting a lot of falsehoods to Twitter.
      - flukus 9y ago
        Shoddy or realistic? I'd hope more security researchers work with systems that aren't perfectly configured because they won't be in the real world.
        9y ago

awqrre 9y ago

Microsoft went Google evil on this product...

dingo_bat 9y ago

I actually like this. Fuck the enterprises who degrade the experience for their users. Disable this disable that. Install shit like McAfee. They just need an excuse for their existence. And the users are the ones to suffer, and the company loses precious productivity without knowing it. I know companies that will pre install McAfee in the brand new MacBooks they give out to employees! It's insane. Microsoft should just say, if you want to use our OS, stop fucking with it.

gub09 9y ago

The "Year of the Linux Desktop" has been a running joke for a long time, but perhaps it's no longer a joke. Not wanting to lose control as far as updates and privacy is concerned, I switched to Linux when Windows 10 came out. Running Debian Testing with Gnome has been a joy. In my opinion the user experience is easier and better than that of Windows 7 or 8. Office staff could quite easily be trained to click on the Start key or the drop-down Activities menu or move the mouse to the top-left corner to start a program. Office software is quite good. Program-switching keyboard combinations are excellent. The Evolution mail client is very good. Browser software is the same as on Windows or a Mac. Problems with bad fonts, poorly designed UI, lacking drivers etc. are things of the past (with the notable exception of very new hardware). This may not be possible due to the necessity of using specific proprietary programs that run only on Windows, for example. On the other hand, the level of tech support required is perhaps not significantly greater than what is necessary for installing and maintaining Windows on a bunch of machines. On the plus side, everything is very fast, tasks like backing up files or systems are simple with GUI or terminal interface, and if you want to learn iptables and set up that router/firewall you can do that too. Everything you learn is an investment instead of an annoyance. Nobody is going through your company or personal files to serve you ads. There's no reason any more, besides defaults and inertia, why Linux should have 2% desktop market share instead of 10% of somewhat technical people or even 20 or 30% of the general population.

partycoder 9y ago

Just a reminder for Windows users: in most cases, you no longer need Windows. All your pain is completely voluntary.

vkou 9y ago
Your pain after you switch to Linux will be completely voluntary, too.
- quickben 9y ago
  Windows pain costs few hundred $ more :)
  - epsylon 9y ago
    Only if your time is worthless.
    - iammyIP 9y ago
      That is quite a stupid argument which you seem to just rephrase without having thought about it, as you could aswell say then that healthy eating takes some more time and consideration than running to the next fast food burger, thus you can only eat healthy if your time is worthless. Or how about developing new energy sources if we can just burn all the oil much easier? Sometimes some efforts have to be done to have nice things. See how dumb this 'Only if your time is worthless' sounds now?
    - partycoder 9y ago
      Linux has evolved a lot. Some years ago it was very likely for you to have to recompile the kernel to get your box running... I haven't been in that scenario lately (using Ubuntu). Then, some distros/desktop environments are even friendlier than Windows itself. elementary OS for instance, is very minimalistic and simple. So I have to disagree with you.
    - quickben 9y ago
      I properly cash in on my time spent learning Linux when I was younger. My free time is worth a lot now ;)

exodust 9y ago

Twitter has this thing called "moments" for combining multiple tweets and avoiding what this person has done. I guess he's only an IT security analyst so perhaps isn't up to speed. https://support.twitter.com/articles/20174961# https://support.twitter.com/articles/20174961#

thr0waway1239 9y ago

This might actually be a pretty huge opportunity for a company which can hand hold the transitioning from Windows to Linux in an enterprise. After all, if the new Windows OS is provably non-compliant, shouldn't the enterprise customers be very willing to investigate this option? Are there already companies which do this?

blitmap 9y ago

I always use Linux as my preferred OS and a "Just Works" OS like macOS or Windows. I run Linux as a dual-boot and I run it in a VM from Windows/mac. It's frustrating because Apple has fallen far behind on hardware I want. I need 3840x2160, a touchscreen, a card reader, both USB 3.0 and 3.1, 16GB of RAM, and full-size HDMI. They've jumped too far ahead into their 'revolutionary' view of the future. I can find better hardware for much cheaper. Dell XPS 13, HP Envy 2-in-1, Toshiba Radius 12... the build quality on the Toshiba is pretty bad, but it out-performs a would-be Macbook. I'm not spending 2 -fucking- thousand dollars for sub-standard hardware simply because I like the OS better than Windows. Apple spies on its users, but at least when you turn it off it's actually off. I can't continue using Windows because it's clearly hostile to users, and I can't go with Apple because the hardware sucks. Linux requires so much involvement to keep it running "well". Just argh.

slazaro 9y ago
We just need a billionaire benevolent dictator to fund a distribution of Linux and relevant programs that turns it into something stable and user friendly.
- deleted 9y ago
  [deleted]
- kogepathic 9y ago
  > We just need a billionaire benevolent dictator to fund a distribution of Linux I might be missing the joke here, is this a jab at Mark Shuttleworth?
  - slazaro 9y ago
    Not intended, but I do think Ubuntu was a missed opportunity by trying to innovate instead of focusing on stability, familiarity, and user-friendliness.
    - madez 9y ago

MikusR 9y ago

https://docs.microsoft.com/lv-lv/windows/configuration/manage-connections-from-windows-operating-system-components-to-microsoft-services https://docs.microsoft.com/lv-lv/windows/configuration/manag...

davidgerard 9y ago

This is the other reason WannaCry happened: 97% Windows 7 machines without updates. Because users can't trust Microsoft not to mess them around.

intoverflow2 9y ago

Ignoring people who need to control what leaves their systems for legal reasons I always find it odd how much the hardcore Windows users freak out over stuff like this. I mean you trust your entire digital life to this OS yet the idea of analytics being sent back to the people who made the OS terrifies you? They also seem to freak out and declare certain versions near unusable when I've recently started using Win 10 after not using Windows since Win 2K and honestly it's 90% the same thing to me. Also interested as to how many people freaking out over telemetry use Google software.

deleted 9y ago

[deleted]

optikals 9y ago

time to switch...